Systems and methods for protecting internet advertising data

ABSTRACT

Systems and methods are disclosed for protecting user privacy in, for example, online advertising environments. The method includes receiving data related to a user in a first communication session between a host server and a client device, and generating a user profile associated with the user. The method further may include encrypting the user profile to produce encrypted user profile data and generating a decryption key for decrypting the encrypted user profile data. Thereafter, either the decryption key or a portion of the encrypted user profile data may be transmitted to the client device and then deleted from host server before ending the first communication session. The method further may include establishing a second communication session between the host server and the client device and retrieving the transmitted content. Then targeted advertising may be provided by decrypting the encrypted user profile data.

PRIORITY

This application is a continuation of U.S. patent application Ser. No.14/518,325, filed on Oct. 20, 2014, which claims the benefit of priorityfrom U.S. Provisional Application No. 62/036,996, filed Aug. 13, 2014,which are hereby incorporated herein by reference in their entirety.

TECHNICAL FIELD

The present disclosure relates generally to electronic and online userprivacy techniques and related systems and methods. More particularly,and without limitation, the present disclosure relates to systems andmethods for protecting user privacy in, for example, online advertisingenvironments.

BACKGROUND

Due to the vast and increasing amount of traffic generated by users onthe Internet, businesses continue to seek more effective means toadvertise their goods and services online. In recant years, the onlineadvertising environment has evolved to enable the use of user profilesfor providing targeted advertising. Such user profiles may provideinsight into a user's habits, personality, shopping trends, in additionto various other details about an individual's life.

One major privacy concern and criticism of interest-based, advertisingis that data that is collected and used to build user profiles andinterest segments may be easily accessed or perused by governmententities or malicious parties. For example, there have been numerousrecent public revelations regarding the easy access that is provided toaggregated user data by some of the largest social media platforms.Implementing targeted ad campaigns involves the audience intelligenceproviders gathering and processing information about users, which isknown as “profiling.” One way intelligence providers gather userinformation is by tracking users as they surf the Internet by usingInternet “cookies.” Generally, a cookie is a email piece of data placedon the user's browser when the user visits a website belonging to an adnetwork. The cookie usually contains, among other things, a uniqueidentifier associated with the user. Depending on the practices of thead network, the cookie may contain other information, such as date andtime information, an estimated zip code of the user, and browser historyinformation. The cookie is stored for a specified time and returnedwhenever the user subsequently visits that website or another website inthe ad network. By compiling and analyzing cookie information associatedwith a particular user gathered across multiple websites, a “userprofile” indicating various attributes, preferences, and/or interests ofthe user can be built. This profile may then be used by ad networksand/or ad exchanges to support targeted ad campaigns. Of course, otheruser tracking methods may be used by intelligence providers to gatherinformation about users and to build user profiles.

Recent improvements in data correlation techniques have allowed thirdparties, such as data brokers and other audience intelligence providers,to link multiple user profiles together, and even to discover real-worlduser identity information. As a result, sensitive information about anindividual may be discovered and misused. Many users are unaware thatpersonal data is being collected from their device and sold to thirdparties. Some people find such user tracking and profiling methodsemployed by online advertisers to be intrusive or invasive, but find“opting-out” to be difficult.

Monetizing data regarding users is important for the ability to provideonline content that is inexpensive from the user's standpoint. However,to maintain user loyalty and usage, privacy concerns have to beaddressed. Embodiments of the current disclosure involve protecting userdata from wholesale harvesting by government entities and would-beattackers, without reducing utility in the data and withoutsignificantly impacting performance in delivery of content to users.

SUMMARY

Various embodiments of the present disclosure relate generally toimproving methods for enhancing security of user data in advertisingenvironments. Each of the embodiments disclosed herein may include oneor more of the features described in connection with any of the otherdisclosed embodiments.

According to some embodiments, computer-implemented methods aredisclosed for protecting user privacy in an online advertisingenvironment. In an exemplary method, the method includes receiving, at ahost server, data related to user in a first communication sessionbetween the host server and a client device, and generating orreceiving, at the host server, a user profile associated with a user,and encrypting the user profile to produce encrypted user profile dataand generating a decryption key for decrypting the encrypted userprofile data. The method may further include transmitting the decryptionkey to the client device, deleting the decryption key from the hostserver, and ending the first communication session, establishing asecond communication session between the host server and the clientdevice, receiving the decryption key from the client device in thesecond communication session, and providing targeted advertising basedin part on decrypting the encrypted user profile data.

According to some embodiments, computer-implemented methods aredisclosed for protecting user privacy in an online advertisingenvironment. In an exemplary method, the method includes receiving, at ahost server, data related to user in a first communication sessionbetween the host server and a client device, and generating orreceiving, at the host server, a user profile associated with a user,and encrypting the user profile to produce encrypted user profile dataand generating a decryption key for decrypting the encrypted userprofile data. The method may further include transmitting a portion ofthe encrypted user profile data to the client device, deleting theportion of the encrypted user profile data from the host server, andending the first communication session, establishing a secondcommunication session between the host server and the client device,receiving the portion of the encrypted user profile data from the clientdevice during the second communication session, and providing targetedadvertising based in part on decrypting the encrypted user profile data.

According to some embodiments, systems are disclosed for protecting userprivacy in an online advertising environment. One system includes amemory having processor-readable instructions stored therein and aprocessor configured to access the memory and execute theprocessor-readable instructions, which when executed by the processorconfigures the processor to perform a method. In an exemplary method,the method includes receiving, at a host server, data related to user ina first communication session between the host server and a clientdevice, and generating or receiving, at the host server, a user profileassociated with a user, and encrypting the user profile to produceencrypted user profile data and generating a decryption key fordecrypting the encrypted user profile data. The method may furtherinclude transmitting the decryption key to the client device, deletingthe decryption key from the host server, and ending the firstcommunication session, establishing a second communication sessionbetween the host server and the client device, receiving the decryptionkey from the client device in the second communication session, andproviding targeted advertising based in part on decrypting the encrypteduser profile data.

According to some embodiments, systems are disclosed for protecting userprivacy in an online advertising environment. One system includes amemory having processor-readable instructions stored therein and aprocessor configured to access the memory and execute theprocessor-readable instructions, which when executed by the processorconfigures the processor to perform a method. In an exemplary method,the method includes receiving, at a host server, data related to user ina first communication session between the host server and a clientdevice, and generating or receiving, at the host server, a user profileassociated with a user, and encrypting the user profile to produceencrypted user profile data and generating a decryption key fordecrypting the encrypted user profile data. The method may furtherinclude transmitting a portion of the encrypted user profile data to theclient device, deleting the portion of the encrypted user profile datafrom the host server, and ending the first communication session,establishing a second communication session between the host server andthe client device, receiving the portion of the encrypted user profiledata from the client device during the second communication session, andproviding targeted advertising based in part on decrypting the encrypteduser-profile data.

According to some embodiments, a non-transitory computer readable mediumis disclosed as storing instructions that, when executed by a computer,cause the computer to perform a method, the method includes receiving,at a host server, data related to user in a first communication sessionbetween the host server and a client device, and generating orreceiving, at the host server, a user profile associated with a user,and encrypting the user profile to produce encrypted user profile dataand generating a decryption key for decrypting the encrypted userprofile data. The method may further include transmitting the decryptionkey to the client device, deleting the decryption key from the hostserver, and ending the first communication session, establishing asecond communication session between the host server and the clientdevice, receiving the decryption key from the client device in thesecond communication session, and providing targeted advertising basedin part on decrypting the encrypted user profile data.

According to some embodiments, a non-transitory computer readable mediumis disclosed as storing instructions that, when executed by a computer,cause the computer to perform a method, the method includes receiving,at a host server, data related to user in a first communication sessionbetween the host server and a client device, and generating orreceiving, at the host server, a user profile associated with a user,and encrypting the user profile to produce encrypted user profile dataand generating a decryption key for decrypting the encrypted userprofile data. The method may further include transmitting a portion ofthe encrypted user profile data to the client device, deleting theportion of the encrypted user profile data from the host server, andending the first communication session, establishing a secondcommunication session between the host server and the client device,receiving the portion of the encrypted user profile data from the clientdevice during the second communication session, and providing targetedadvertising based in part on decrypting the encrypted user profile data.

It is to be understood that both the foregoing general description andthe following detailed description are exemplary and explanatory onlyand are not restrictive of the disclosed embodiments, as claimed.

BRIEF DESCRIPTION OF THE DRAWINGS

The accompanying drawings, which are incorporated in and constitute apart of this specification, illustrate exemplary embodiments of thepresent disclosure and, together with the description, serve to explainthe principles of the disclosure.

FIG. 1 shows a block diagram of an exemplary online advertisingenvironment for providing consumer privacy, consistent with exemplaryembodiments;

FIG. 2 is a flow diagram of an exemplary method for protecting userprivacy in an online advertising environment, according to an embodimentof the present disclosure;

FIGS. 3A and 3B are schematics of an exemplary scenario for protectinguser privacy, according to an embodiment of the present disclosure;

FIG. 4 is a flow diagram of another exemplary method for protecting userprivacy in an online advertising environment, according to an embodimentof the present disclosure;

FIGS. 5A and 5B are schematics of an exemplary scenario for protectinguser privacy, according to an embodiment of the present disclosure; and

FIG. 6 is a simplified functional block diagram of a computer and/orserver that may be configured as a device or system performing privacyfriendly online advertising, according to an exemplary embodiment of thepresent disclosure.

DETAILED DESCRIPTION

The present disclosure describes systems and methods for protecting theidentity of a user in online advertising environment. While principlesof the current disclosure are described with reference to onlineadvertising, it should be understood that the disclosure is not limitedthereto. Rather, the systems and methods of the present disclosure maybe used in any networked system to provide identity protection.

In an exemplary embodiment, when a user visits the web page of apublisher, the instance of the publisher web page executing in theuser's browser generate a request for ads to fill any available ad spaceon the page. Based on an identity of a user, the user's profile,context, current location, and/or an interest score assigned to theuser, targeted advertising may be provided for a user. In someembodiments, an interest score may be generated the first time that anadvertising server interacts with a new user. Additionally, a unique Idcookie may be created and provided to the client device. Thereafter,based on any additional interactions with a user, the interest scoresmay periodically be updated. The interest scores and/or a user profilegenerated based on user behavior may enable an ad network and/or adexchange to select and serve a targeted ad for displaying anadvertisement on a user's browser based on a target audience selectedbased on that interest score and/or user profile.

Embodiments consistent with the present disclosure aid in protectinguser privacy, such as protecting user profile data including interestscores in online advertising environments. In one embodiment, one ofboth of two separate approaches may be taken for ensuring that sensitiveuser targeting data is encrypted and accessible only when a clientdevice is communicating with an advertising server. In both of theapproaches, user profile data may be created, encrypted, and then storedso that it is accessible only in real time, for example, when targetedadvertising is requested. As discussed above, user profile data may beindicative of a user's preferences and/or predicted responsiveness toparticular advertising content. In a first approach, when the userprofile data is encrypted, a decryption key may be transmitted to aclient device (or client server) and stored therein, so that the userprofile data may be decrypted only when the client and a host server areconnected. In a second approach, the decryption key may remain stored atthe host server but part of the encrypted user profile data is storedonly at the client device (or client server). Accordingly, in thisexemplary scenario, the host and client must be connected for anydecryption to occur. Accordingly, both of these exemplary approachesprovide an advantage that the host server (hosting entity) is unable todecrypt encrypted user profile data on its own without connecting with aclient device, thereby allowing for preservation of data privacy.

Reference will now be made in detail to the exemplary embodiments of thedisclosure, examples of which are illustrated in the accompanyingdrawings. Wherever possible, the same reference numbers will be usedthroughout the drawings to refer to the same or like parts.

FIG. 1 is a schematic diagram of an exemplary network environment inwhich various user interfaces may display online content, according toan embodiment of the present disclosure. As shown in FIG. 1, theenvironment may include a plurality of user or client devices 102 thatare communicatively coupled to each other as well as a plurality ofserver systems 106 via an electronic network 100. Electronic network 100may include one or a combination of wired and/or wireless electronicnetworks. Network 100 may also include a local area network, a mediumarea network, or a wide area network, such as the Internet.

In one embodiment, each of user or client devices 102 may be any type ofcomputing device configured to send and receive different types ofcontent and data to and from various computing devices via network 100.Examples of such a computing device include, but are not limited to, adesktop computer or workstation, a laptop computer, a mobile handset, apersonal digital assistant (PDA), a cellular telephone, a networkappliance, a camera, a smart phone, an enhanced general packet radioservice (EGPRS) mobile phone, a media player, a navigation device, agame console, a set-top box, or any combination of these or other typesof computing devices having at least one processor, a local memory, adisplay (e.g., a monitor or touchscreen display), one or more user inputdevices, and a network communication interface. The user input device(s)may include any type or combination of input/output devices, such as akeyboard, touchpad, mouse, touchscreen, camera, and/or microphone.

In one embodiment, each of the user or client devices 102 may beconfigured to execute a web browser or mobile browser, IV set-top box,or other software application capable of communicating across a network(such as a mobile application) installed for displaying various types ofcontent and data received from any of server systems 106 via network100. Server systems 108 in turn may be configured to receive datarelated to user interaction with the web browsers or mobile browsers, TVset-top boxes/programming, or other client software displayed in theuser or client devices 102. The user interaction may occur at eachdevice 102 through an interlace provided on a web page loaded within thebrowser executable or user interface at each device. It should be notedthat server systems 106 may be implemented using a single server deviceor system or may refer to a combination of multiple servers.Additionally, server systems 106 may contain one or more additionalservers, such as an advertising server (not illustrated) and aggregatescoring server (not illustrated).

An exemplary advertising server may be configured to receive a requestto fill any available ad space on a web page of a publisher with theinstance of the publisher web page or user interface executing in theuser's browser, TV set-top box, or other client software generating therequest. The advertising server may also determine whether a particularuser is the target audience for a particular advertisement. An interestscoring server may comprise an interest scoring system, which provides ascore to each individual user based on likely interest in variousadvertising offers and subject matters. An exemplary interest scoringsystem receives a request with a unique identifier, and subsequentlychecks to see if there is any existing information in the system forthat identifier. If no data related to a particular identifier isincluded, then new data may be created for the unique identify. The datareflects a user's online or offline activities and/or their userprofile. A score may be assigned to such online activities and/or theiruser profile and may be stored by the exemplary interest scoring system.If previous data related to a unique identity, previously existed, thanthe previous data is updated.

Server systems 106 may also be configured to encrypt and decrypt dataassociated with a user including user profile data. Further details withrespect to encryption and decryption are provided in the explanationaccompanying FIGS. 2-5B.

As shown in FIG. 1, server systems 106 may include processor 110. In anembodiment, processor 110 may be configured to execute a process forprotecting user privacy in an advertising environment, as will bedescribed in further detail below with respect to FIGS. 2-5B. In oneembodiment, optimizing processor 110 may be configured to receiveinstructions and content from various sources including user or clientdevices 102 and to store the received content within databases 103. Inan embodiment, databases 108 may be any type of data store or recordingmedium that may be used to store any type of data. For example,databases 108 may store demographic and metrics of target audiences foradvertising, user profile data, advertising content, encrypted data,decrypted data, user-generated content, online and office activity,location data, etc. Databases 108 may also store information related tothe target audience, individual user profiles, encrypted data, anddecrypted data. In some implementations, data may be stored in thedatabases 108 in an encrypted form to increase security of the dataagainst unauthorized access. Processor 110 or any additional processorswithin server systems 106 may also be configured to provide content toclient or user devices 102 for display. The displayed content mayinclude, for example, any online content that has been processed orreceived with embedded advertising content. For example, processor 110may transmit web page content including targeted advertising. In someembodiments, client devices 102 may be used by certain users to input ormanage content that is managed by processor 110. For example, specificmetrics regarding what kind of targeted advertising may be provided,accessed, and/or controlled by an advertising entity using one of theuser or client devices 102.

FIG. 2 is a flow diagram of a method 200 for protecting user privacy inan online advertising environment, according to an exemplary embodimentof the present disclosure. In further detail, as shown in FIG. 2, step202 of method 200 may include receiving, at a host server, data relatedto a user in a first communication session between the host server and aclient device. Specifically, server systems 106 (or vice-versa) mayestablish a first communication session with one of user devices 102.The session may be authenticated using any desired methods. During thefirst session, data related to a user associated with user device 102may include but is not limited to device identity associated with auser, demographic data, user behavior, user preferences, etc. Forexample, user preference data may be gathered by websites affiliatedwith ad networks and/or general browsing behavior. Additional data maybe captured including exposure to broadcast content, for example,tracing of broadcast content via a television set-top box,podcast-capable device, or other Internet-based broadcast. Furthermore,precise location data and behavioral data may be collected and/ordiscerned from mobile devices and/or interactions with physical beaconsin various locations such as related stored. Devices at a location maybe determine an identify of a user or determine device identity throughdevice characteristics (e.g., wireless or Bluetooth emissions), voice orimage recognition data collected through mobile device or in-storecameras and beacons, and using in-vehicle data collection appliances orsoftware (e.g. navigation systems or onboard network connectedcomputers). The data may further include additional offline activity,data related to a user's purchasing behavior, and data shared byadditional data aggregators.

Step 204 of method 200 may include generating or receiving a userprofile associated with the user. For example, user profile may begenerated within server systems 106 based on the received data that isassociated with the user. In some embodiments, server systems 106 mayalso retrieve data from additional sources within environment 100 whichmay provide additional information for generation of a user profile inaddition to the received data. This may include demographic information,general population patterns, specific personal data of the userassociated with a client device, etc. Therefore, an exemplary userprofile may be based on user behavior along with any additional datathat may be available regarding the user (for example, demographicinformation) associated with user device 102.

In some embodiments, an interest score may be generated and serve as auser profile associated with a user. The interest score may bedetermined for a user based on the received data and any previouslystored data. As discussed above, the interest score may be indicative ofa user's behavior and/or personality.

In embodiments, a user profile and interest score may be based on anyactivity performed via an electronic device or under the observation ofan electronic device. Accordingly, the electronic device may collectdata related to the activity and may use it for generating a userprofile and/or interest score. The various activities may include, butare not limited to, viewing a TV program via a set-top box, interactingwith a web browser or mobile/tablet application, driving or riding anetwork-connected vehicle, purchasing goods or services via electronicpayment methods, such as, credit cards, mobile devices, shopping in astore with a video camera/system capable of facial recognition, carryinga mobile device that broadcasts user/device specific details in or nearan establishment or other devices capable of discerning such details,etc., and interacting with physical kiosks that can discern identity oruniqueness.

Step 206 of method 200 may include encrypting the user profile toproduce encrypted user profile data and generating a decryption key fordecrypting the encrypted user profile data. The user profile may beencrypted to produce encrypted user profile data using any desiredmethods. Accordingly, information related to a user may be stored in asecure manner by encrypting the data, where a decryption key is used todecrypt this data in a fast manner. For example, FIG. 3A illustrates anexemplary scenario in which a user profile is generated. Connection 302between server systems 106 and user device 102 represents a firstcommunication session. Encrypted user profile data 304 based on a userprofile associated with a user may be stored within server systems 106along with a corresponding decryption key 306 that may be used todecrypt the encrypted user profile data 304.

Step 208 of method 200 may include transmitting, to the client device,the decryption key. For example, server systems 106 may transmit thedecryption key associated with the encrypted user profile data to clientdevice 102. In embodiments, easy decryption of encrypted user profiledata involves access to the decryption key. Continuing the example frombefore, transmission 308 represents transmission of the decryption key306 from server systems 106 to user device 102.

Step 210 of method 200 may include deleting the decryption key from thehost server and ending the first communication session. For example, thedecryption key may be affirmatively deleted from server systems 106 andall other elements of environment 100, except a copy that is retained atuser device 102 associated with the user. Additionally, thecommunication session between user device 102 and server systems 106 maybe closed or ended so that they are no longer in communication with eachother. Continuing the example from before, FIG. 3B represents anexemplary scenario after a transmission of decryption key 306 fromserver systems 106 to user device 102 has occurred and connection 302has ended. Furthermore, in this exemplary scenario, a copy of decryptionkey 306 is stored only within user device 102 and all other copies fromserver systems 106 or other elements of environment 100 have beendeleted. Accordingly, even if an entity were able to access theencrypted user profile data 304 within server systems 106, the entitywould have no easy approach to decrypt the data without access to userdevice 102. Since user device 102 is not connected to server systems106, user data security is considerably enhanced.

Step 212 of method 200 may include establishing a second communicationsession between the host server and the client device. Specifically,server systems 106 (or vice-versa) may establish a second communicationsession with one of user devices 102. The session may be authenticatedusing known methods in the art.

Step 214 of method 200 may include receiving the decryption key from theclient device in the second communication session. For example, whenevera connection session between server systems 108 and user device 102 isestablished, any decryption keys related to the user device 102(associated user) may be automatically transmitted from user device 102to server systems 108. Alternatively, server systems 106 may requestspecific decryption keys from user device 102 and, responsive to saidrequest, user device 102 may transmit the decryption key to serversystems 106.

In embodiments, a user may be provided a notification which may allowthem to select not to transmit the decryption key. For example a usermay be able to provide consent or explicitly deny key transmission undercircumstances, such as, making a selection to not transmit thedecryption key from the client device when engaged in private browsing.

Step 216 of method 200 may include providing targeted advertising basedin part on decrypting the encrypted user profile data. In detail, usingthe received (or retrieved) decryption key, encrypted user profile datamay be decrypted for re-generating and/or accessing the user profile. Anadvertising entity may provide data related to a targeted audience foradvertising content. Then, the user profile of a user associated with aparticular client device may be used to determine which advertisementsshould be provided to the user. For example, demographics of targetedpotential customers may be compared with a user profile associated witha user and, based on the similarity, targeted advertising may beprovided.

Accordingly, exemplary method 200 aids in enhancing protection ofencrypted data by storing associated decryption keys in a differentphysical location than the encrypted user profiles. Furthermore,security is enhanced since the decryption keys are not accessible unlessa communication session is established between server systems 106 (hostserver) and user device 102. Accordingly, an entity which is able togain access to encrypted data stored in systems servers 106 would haveto go through a tedious and/or illegal process to decrypt any accessed(or stolen) data without access to the decryption keys.

In embodiments, in each subsequent connected session between serversystems 106 and user device 102, previously stored encrypted userprofile data may be decrypted and may be updated to generate an updateduser profile. The updated user profile may then be encrypted and theassociated decryption key may then be transferred to user device 102 anddeleted from server systems 106. Therefore, in each subsequent session,the user profile may be easily accessed and updated. However, dataprivacy is enhanced since, for access of a user profile and/or to updatethe user profile, a connection session between a client device and thehost server must be established. Further, decryption keys may be furtherupdated with each interaction or data update, continually enhancingsecurity. Once any data within server systems 106 is updated, a newdecryption key may be generated, and the key may be transmitted to userdevice 102 and deleted from server systems 106.

FIG. 4 is a flow diagram of a method 400 for protecting user privacy inan online advertising environment, according to another embodiment ofthe present disclosure. In an exemplary embodiment, step 402 may includereceiving, at a host server, data related to a user in a firstcommunication session between the host server and a client device. In anexemplary embodiment, step 402 may be performed similarly to step 202 ofmethod 200.

Step 404 of method 400 may include generating or receiving a userprofile associated with the user. In an exemplary embodiment, step 404may be performed similar to method 204 of step 200.

Step 406 of method 400 may include encrypting the user profile toproduce encrypted user profile data, and generating a decryption key fordecrypting the encrypted user profile data. In an exemplary embodiment,step 406 may be performed similar to method 206 of method 200. Forexample, FIG. 5A illustrates an exemplary scenario in which a userprofile is generated. Connection 502 between server systems 106 and userdevice 102 may represent a first communication session. Encrypted userprofile data 504 may be based on a user profile associated with a userand may be stored within server systems 106 along with a correspondingdecryption key 506 that may be used to decrypt the encrypted userprofile data 304.

In some embodiments, encrypted user profile data may be split at leastinto two portions. In one embodiment, the user profile data may bedivided into a large portion and a small portion. The smaller portionmay be large enough to be mathematically relevant such that theremaining portion of the encrypted user profile data may not bedecrypted using the decryption key without the missing portion. Forexample, encrypted user profile data 504 may be split into firstencrypted data portion 510 and second encrypted data portion 512.Accordingly, neither of the first user first encrypted data portion 510and the second encrypted data portion 512 may be decrypted by themselvesusing decryption key 508. Therefore, a user must possess completeencrypted profile data 504 (including first encrypted portion 510 andsecond encrypted portion 512) and decryption key 506 to decrypt any ofthe encrypted data.

Step 408 of method 400 may include transmitting, to the client device, aportion of the encrypted user profile data. For example, after splittingthe encrypted user profile data 504 into multiple portions, serversystems 108 transmit a portion of encrypted user profile data t504 oclient device 102. Continuing the example from above, transmission 508may represent transmission of second encrypted data portion 512 fromserver systems 106 to user device 102. Accordingly, because a portion ofthe encrypted user profile data is transmitted, decryption of theremaining encrypted data may not be conducted in server systems 108 bysimply using the decryption key 506, as described in further detailabove.

Step 410 of method 400 may include deleting the portion of the encrypteduser profile data from the host server and ending the firstcommunication session. For example, the transmitted portion of theencrypted user profile data may be affirmatively deleted from serversystems 106 and all other elements of environment 100, except that itmay be retained at user device 102 associated with the user.Additionally, the communication session between user device 102 andserver systems 106 may be closed or ended so that they are no longer incommunication with each other. Continuing the example from before, FIG.5B represents an exemplary scenario after a transmission of secondencrypted portion 512 from server systems 106 to user device 102 hasoccurred and connection 302 has ended. Additionally, a copy of secondencrypted data portion 512 is stored only within user device 102 and allother copies from server systems 106 or other elements of environment100 have been deleted. Accordingly, even if an entity were able toaccess the first encrypted data portion 510 and decryption key 506within server systems 106, the entity would have no easy approach todecrypt the data without access to user device 102. Since user device102 is not connected continuously to server systems 106, user datasecurity is considerably enhanced.

Step 412 of method 400 may include establishing a second communicationsession between the host server and the client device. Specifically,server systems 106 (or vice-versa) may establish a second communicationsession with one of user devices 102. The session may be authenticatedusing any desired method.

Step 414 of method 400 may include receiving the portion 512 of theencrypted user profile data from the client device during the secondcommunication session. For example, whenever a connection sessionbetween server systems 106 and user device 102 is established, anyportions of the encrypted user profile data may be automaticallytransmitted from user device 102 to server systems 106. Alternatively,server systems 106 may request specific missing portions of theencrypted user profile data from user device 102 and, responsive to sucha request, user device 102 may transmit the portion of the encrypteduser profile data to server systems 106. For example, second encrypteddata portion 512 may be transmitted from user device 102 to serversystems 106.

Step 416 of method 400 may include providing targeted advertising basedin part on decrypting the combined encrypted user profile data. Indetail, by first combining the received (or retrieved) portion ofencrypted data with portions of encrypted data stored within serversystems 106, encrypted user profile data may be decrypted forre-generating the user profile. Thereafter, the user profile may be usedsimilarly to step 216 of method 200 for providing targeted advertisingcontent.

The examples described above with respect to FIGS. 1-5, or any part(s)or function(s) thereof, may be implemented using hardware, softwaremodules, firmware, tangible computer readable media having instructionsstored thereon, or a combination thereof and may be implemented in oneor more computer systems or other processing systems.

FIG. 6 illustrates a high-level functional block diagram of an exemplarycomputer system 600, in which embodiments of the present disclosure, orportions thereof, may be implemented, e.g., as computer-readable code.For example, each of the exemplary devices and systems described abovewith respect to FIG. 1 can be implemented in computer system 600 usinghardware, software, firmware, tangible computer readable media havinginstructions stored thereon, or a combination thereof and may beimplemented in one or more computer systems or other processing systems.Hardware, software, or any combination of such may embody any of themodules and components in FIG. 1, as described above.

If programmable logic is used, such logic may execute on a commerciallyavailable processing platform or a special purpose device. One ofordinary skill in the art may appreciate that embodiments of thedisclosed subject matter can be practiced with various computer systemconfigurations, including multi-core multiprocessor systems,minicomputers, mainframe computers, computers linked or clustered withdistributed functions, as well as pervasive or miniature computers thatmay be embedded into virtually any device.

For instance, at least one processor device and a memory may be used toimplement the above-described embodiments. A processor device may be asingle processor, a plurality of processors, or combinations thereof.Processor devices may have one or more processor “cores.”

Various embodiments of the present disclosure, as described above in theexamples of FIGS. 1-5 may be implemented using computer system 800.After reading this description, it will become apparent to a personskilled in the relevant art how to implement embodiments of the presentdisclosure using other computer systems and/or computer architectures.Although operations may be described as a sequential process, some ofthe operations may in fact be performed in parallel, concurrently,and/or in a distributed environment, and with program code storedlocally or remotely for access by single or multi-processor machines. Inaddition, in some embodiments the order of operations may be rearrangedwithout departing from the spirit of the disclosed subject matter.

As shown in FIG. 6, computer system 600 includes a central processingunit (CPU) 620. CPU 620 may be any type of processor device including,for example, any type of special purpose or a general-purposemicroprocessor device. As will be appreciated by persons skilled in therelevant art, CPU 620 also may be a single processor in amulti-core/multiprocessor system, such system operating alone, or in acluster of computing devices operating in a cluster or server farm. CPU620 is connected to a data communication infrastructure 610, forexample, a bus, message queue, network, or multi-core message-passingscheme.

Computer system 600 also includes a main memory 640, for example, randomaccess memory (RAM), and may also include s secondary memory 630.Secondary memory 630, e.g., a read-only memory (ROM), may be, forexample, a hard disk drive or a removable storage drive. Such aremovable storage drive may comprise, for example, a floppy disk drive,a magnetic tape drive, an optical disk drive, a flash memory, or thelike. The removable storage drive in this example reads from and/orwrites to a removable storage unit in a well-known manner. The removablestorage unit may comprise a floppy disk, magnetic tape, optical disk,etc. which is read by and written to by the removable storage drive. Aswill be appreciated by persons skilled in the relevant art, such aremovable storage unit generally includes a computer usable storagemedium having stored therein computer software and/or data.

In alternative implementations, secondary memory 630 may include othersimilar means for allowing computer programs or other instructions to beloaded into computer system 600. Examples of such means may include aprogram cartridge and cartridge interface (such as that found in videogame devices), a removable memory chip (such as an EPROM, or PROM) andassociated socket, and other removable storage units and interfaces,which allow software and data to be transferred from a removable storageunit to computer system 600.

Computer system 600 may also include a communications interface (“COM”)660. Communications interface 680 allows software and data to betransferred between computer system 600 and external devices.Communications interface 660 may include a modern, a network interface(such as an Ethernet card), a communications port, a PCMCIA slot andcard, or the like. Software and data transferred via communicationsinterface 660 may be in the form of signals, which may be electronic,electromagnetic, optical, or other signals capable of being received bycommunications interface 660. These signals may be provided tocommunications interface 660 via a communications path of computersystem 600, which may be implemented using, for example, wire or cable,fiber optics, a phone line, a cellular phone link, an RF link or othercommunications channels.

The hardware elements, operating systems, and programming languages ofsuch equipment are conventional in nature, and it is presumed that thoseskilled in the art are adequately familiar therewith. Computer system600 also may include input and output ports 650 to connect with inputand output devices such as keyboards, mice, touchscreens, monitors,displays, etc. Of course, the various server functions may beimplemented in a distributed fashion on a number of similar platforms,to distribute the processing load. Alternatively, the servers may beimplemented by appropriate programming of one computer hardwareplatform.

Program aspects of the technology may be thought of as “products” or“articles of manufacture” typically in the form of executable codeand/or associated data that is carried on or embodied in a type ofmachine-readable medium. “Storage” type media include any or all of thetangible memory of the computers, processors or the like, or associatedmodules thereof, such as various semiconductor memories, tape drives,disk drives and the like, which may provide non-transitory storage atany time for the software programming. All or portions of the softwaremay at times be communicated through the Internet or various othertelecommunication networks. Such communications, for example, may enableloading of the software from one computer or processor into another, forexample, from a management server or host computer of the mobilecommunication network into the computer platform of a server and/or froma server to the mobile device. Thus, another type of media that may bearthe software elements includes optical, electrical and electromagneticwaves, such as used across physical interfaces between local devices,through wired and optical landline networks and over various air-links.The physical elements that carry such waves, such as wired or wirelesslinks, optical links, or the like, also may be considered as mediabearing the software. As used herein, unless restricted tonon-transitory, tangible “storage” media, terms such as computer ormachine “readable medium” refer to any medium that participates inproviding instructions to a processor for execution.

It would also be apparent to one of skill in the relevant art that thepresent disclosure, as described herein, can be implemented in manydifferent embodiments of software, hardware, firmware, and/or theentitles illustrated in the figures. Any actual software code with thespecialized control of hardware to implement embodiments is not limitingof the detailed description. Thus, the operational behavior ofembodiments will be described with the understanding that modificationsand variations of the embodiments are possible, given the level ofdetail presented herein.

It is to be understood that both the foregoing general description andthe following detailed description are exemplary and explanatory onlyand are not restrictive of the disclosed embodiments, as claimed.

Other embodiments of the disclosure will be apparent to those skilled inthe art from consideration of the specification and practice of theinvention disclosed herein. It is intended that the specification andexamples be considered as exemplary only, with a true scope and spiritof the invention being indicated by the following claims.

What is claimed is:
 1. A computer-implemented method for protecting userprivacy in an online advertising environment, the method comprising:encrypting a profile of user behavioral data associated with a user toproduce encrypted user behavior profile data and generating a decryptionkey for the encrypted user behavior profile data; splitting theencrypted user behavior profile data into a first portion of theencrypted user behavior profile data and a second portion of theencrypted user behavior profile data such that the second portion of theencrypted user behavior profile data is required for decrypting thefirst portion of the encrypted user behavior profile data; transmittingthe second portion of the encrypted user behavior profile data to theclient device in a first communication session between the host serverand a client device, deleting the second portion of the encrypted userbehavior profile data from the host server subsequent to transmittingthe second portion, and ending the first communication session;establishing a second communication session between the host server andthe client device; receiving the second portion of the encrypted userbehavior profile data from the client device during the secondcommunication session; and decrypting the first portion of the encrypteduser behavior profile data and the retrieved second portion of theencrypted user behavior profile data.
 2. The computer-implemented methodof claim 1, wherein the profile of user behavioral data associated withthe user is generated, at the host server, from behavioral data relatedto the user received, at the host server, in the first communicationsession.
 3. The computer-implemented method of claim 1, furthercomprising: providing targeted advertising based in part on thedecrypted first portion of the encrypted user behavior profile data andthe retrieved second portion of the encrypted user behavior profiledata, wherein providing targeted advertising based in part on decryptingthe encrypted user behavior profile data comprises: combining the firstportion of the encrypted user behavior profile data and the retrievedsecond portion of the encrypted user behavior profile data; regeneratingthe profile of user behavioral data based on decrypting the encrypteduser behavior profile data; determining a target audience foradvertising content; and providing targeted advertising based on thetarget audience and the profile of user behavioral data.
 4. Thecomputer-implemented method of claim 3, further comprising: updating theprofile of user behavioral data based on the user's responsiveness tothe targeted advertising.
 5. The computer-implemented method of claim 1,further comprising: storing the decryption key and the second portion ofencrypted user behavior profile data in the host server.
 6. Thecomputer-implemented method of claim 1, wherein the behavioral datarelated to user includes data generated by one or more of: interactingwith physical beacons, viewing content via a set-top box,podcast-capable device, or internet-based broadcast, interacting with aweb browser, mobile application, or tablet application, driving orriding a network-connected vehicle, purchasing goods or services viaelectronic payment methods, credit cards, or mobile devices, travelingin an area with a video surveillance system capable of facialrecognition, or carrying a mobile device that broadcasts user specificdetails or device specific details.
 7. The computer-implemented methodof claim 6, wherein the profile of user behavioral data includes aninterest score.
 8. The computer-implemented method of claim 7, whereinthe interest score is used to provide targeted advertising.
 9. Thecomputer-implemented method of claim 1, further comprising: transmittinga request from the host server to the client device for the secondportion of the encrypted user behavior profile data in the secondcommunication session.
 10. The computer-implemented method of claim 1,further comprising: updating, at the host server, the profile of userbehavioral data associated with a user during the second communicationsession; encrypting the updated profile of user behavioral data toproduce encrypted updated user behavioral profile data and generating anupdated decryption key for decrypting the encrypted updated userbehavioral profile data; transmitting a portion of the encrypted updateduser behavioral profile data to the client device, deleting the portionof the encrypted updated user behavioral profile data from the hostserver and ending the second communication session; establishing a thirdcommunication session between the host server and the client device;receiving the portion of the encrypted updated user behavioral profiledata from the client device during the third communication session; andproviding targeted advertising based in part on decrypting the updatedencrypted user behavior profile data.
 11. A system for protecting userprivacy in an online advertising environment, the system comprising: adata storage device storing instructions; and a processor configured toexecute the instructions to perform a method comprising: receiving, at ahost server, data related to a user in a first communication sessionbetween the host server and a client device; encrypting a profile ofuser behavioral data associated with a user to produce encrypted userbehavior profile data and generating a decryption key for the encrypteduser behavior profile data; splitting the encrypted user behaviorprofile data into a first portion of the encrypted user behavior profiledata and a second portion of the encrypted user behavior profile datasuch that the second portion of the encrypted user behavior profile datais required for decrypting the first portion of the encrypted userbehavior profile data; transmitting the second portion of the encrypteduser behavior profile data to the client device in a first communicationsession between a host server and a client device, deleting the secondportion of the encrypted user behavior profile data from the host serversubsequent to transmitting the second portion, and ending the firstcommunication session; establishing a second communication sessionbetween the host server and the client device; receiving the secondportion of the encrypted user behavior profile data from the clientdevice during the second communication session; and decrypting the firstportion of the encrypted user behavior profile data and the retrievedsecond portion of the encrypted user behavior profile data.
 12. Thesystem of claim 11, wherein the profile of user behavioral dataassociated with the user is generated, at the host server, frombehavioral data related to the user received, at the host server, in thefirst communication session.
 13. The system of claim 11, wherein themethod further comprises: providing targeted advertising based in parton the decrypted first portion of the encrypted user behavior profiledata and the retrieved second portion of the encrypted user behaviorprofile data, wherein providing targeted advertising based in part ondecrypting the encrypted user behavior profile data comprises: combiningthe first portion of the encrypted user behavior profile data and theretrieved second portion of the encrypted user behavior profile data;regenerating the profile of user behavioral data based on decrypting theencrypted user behavior profile data; determining a target audience foradvertising content; and providing targeted advertising based on thetarget audience and the profile of user behavioral data.
 14. The systemof claim 13, wherein the method further comprises: updating the profileof user behavioral data based on the user's responsiveness to thetargeted advertising.
 15. The system of claim 11, wherein the methodfurther comprises: storing the decryption key and the second portion ofencrypted user behavior profile data in the host server.
 16. The systemof claim 11, wherein the behavioral data related to user includes datagenerated by one or more of: interacting with physical beacons, viewingcontent via a set-top box, podcast-capable device, or internet-basedbroadcast, interacting with a web browser, mobile application, or tabletapplication, driving or riding a network-connected vehicle, purchasinggoods or services via electronic payment methods, credit cards, ormobile devices, traveling in an area with a video surveillance systemcapable of facial recognition, or carrying a mobile device thatbroadcasts user specific details or device specific details.
 17. Thesystem of claim 16, wherein the profile of user behavioral data includesan interest score.
 18. The system of claim 17, wherein the interestscore is used to provide targeted advertising.
 19. The system of claim11, wherein the method further comprises: transmitting a request fromthe host server to the client device for the second portion of theencrypted user behavior profile data in the second communicationsession.
 20. The system of claim 11, wherein the method furthercomprises: updating, at the host server, the profile of user behavioraldata associated with a user during the second communication session;encrypting the updated profile of user behavioral data to produceencrypted updated user behavioral profile data and generating an updateddecryption key for decrypting the encrypted updated user behavioralprofile data; transmitting a portion of the encrypted updated userbehavioral profile data to the client device, deleting the portion ofthe encrypted updated user behavioral profile data from the host server,and ending the second communication session; establishing a thirdcommunication session between the host server and the client device;receiving the portion of the encrypted updated user behavioral profiledata from the client device during the third communication session; andproviding targeted advertising based in part on decrypting the updatedencrypted user behavior profile data.